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DIGITALEUROPE is of the opinion that contractual relations and existing rules are sufficient. It is currently premature to conclude 
that new legislation is needed. The existing rules should be carefully assessed according to various use cases and soft regulation 
should be promoted. 


The European Commission has carried out various rounds of consultations on the question of data ownership, access and 
liability. All of these consultations have lead to the same conclusion: legislative intervention is not necessary. The existing 
framework and contractual arrangements provide a sufficient legal framework. 


First, the responses to the public consultation on platforms, which also touched upon this question, indicated that “it is not 
necessary to regulate access to, transfer and the use of non-personal data at European level.” The majority of business 
groups, like DIGITALEUROPE, were also “against specific measures, claiming that any new restrictions on data not covered 
by the (personal) data protection regime should be avoided in order to deliver maximum benefit to the economy and 
society.” Respondents also highlighted the absence of proof of market failure and that “data protection laws deal adequately 
with issues of ownership, use and access regarding personal data.” The answers also indicated that there is no need fora 
new or specific liability regime as the current framework is sufficiently technology neutral. “It was emphasized by many 
respondents that there is nothing intrinsically different about loT that calls into question existing liability regimes.” (See 
Synopsis Report on the Contributions to the Public Consultation - Regulatory Environment for data and cloud computing.). 


Further to the public consultation, the Commission has organised various workshops where the same issue was discussed 
and the same feedback was provided. During these workshops, participants emphasized that there is “no need to create any 
new data exploitation right or similar”, as the “creation of any new right to data may actually complicate or even hinder the 
free flow of data”. 


Some Member States are also looking into this question, but the preliminary results “confirm the view stated above that no 
legislative intervention is desirable at this stage.” (See Synthesis report - EC Round Table - an efficient and fair access to and 
usage and exchange of data.”) 


Against this background, it is somewhat unclear what challenges the Commission is trying to address. 


As the Commission nevertheless continues to assess this question, we would like to make the following observations. Very 
often you hear that datais the “new currency”. The increasing use of datahas initiated a debate on 
“data ownership”. However, data in itself is only an abstract concept and should not be regulated as such. Understanding 
the context in which data is to be used is in fact crucial and is also important in the context of Internet of Things and free 
flow of data discussions. 
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As the OECD highlighted, “in contrast to other intangibles, data typically involve complex assignments of different rights 
across different stakeholders who will typically have different power over the data depending on their role.” This is also the 
case with the Internet of Things, where there are a number of different actors along the data processing chain. 
The data processing chain may span many different contexts from B2C to B2B including M2M. Understanding each actor's 
role within the data processing chain is key and the rights on data are set by the contractual or licensing framework 
combined with the regulatory framework for personal data. 


The key is flexibility. 


Access to, transfer and the use of data, is already covered by the existing legal framework, including, data protection, 
competition, unfair commercial practices, contract and consumer protection law, intellectual property laws, including, the 
database directive and the new trade secrets directive. To the extent that the processing (including access, transfer and use) 
relates to personal data, which is very broadly defined in Europe encompassing any data that has the ability to identify an 
individual. The rights of individuals are extensively regulated by the current and upcoming data protection rules. Rights of 
access and use between commercial parties processing both personal and non-personal data should be set by contractual 
relations between the various parties involved. Because we do not see market failure or particular need, we are sceptical 
about the need for model contracts or model licences. The flexibility of existing contractual practices, complemented by 
existing legislation is in our view sufficient. 


In the B2B context, the data accessed and used is usually defined through contracts between the different companies or 
organisations involved. Given the disparate entities potentially involved in the offering and differences in the nature and 
purposes behind the generation of certain types of data, we —as the majority of the respondents to the various consultations 
with the Commission - are not convinced that a uniform regulatory solution is preferable to existing contract 
negotiations. Not all of the actors involved in a ‘system’ will have equal claim to all types of data. Where additional analysis 
or combinations of data have been used to draw out new insights this is clearly added-value brought to the data by the 
processor in question. Even the customer who opts for a specific solution may not need access to all the data being 
generated. Some data may be business confidential, whereas in other cases they may decide they have limited interest in 
the data in question and may be willing to trade it against other advantages in contract negotiations. Without evidence that 
such negotiations are proving unworkable, we do not see a need for regulatory intervention. 


In the B2C context it is assumed that the data subject has the right under the current and future data protection rules to 
transparency and control with regard to the use of their personal data. However, there are clear benefits to sharing such 
information in an aggregated and anonymized format and the urge for an all-encompassing interpretation of the personal 
data definition should be balanced with these gains. For example, one must consider intelligent transport management 
which requires the collection of personal location data to map and predict traffic flow. Accuracy improves as more 
traffic data is connected. 


To conclude, as demonstrated by the various consultations launched by the Commission, contractual relations and existing 
rules are sufficient. It is currently premature to conclude that new legislation is needed. The existing rules should be carefully 
assessed according to various use cases and soft regulation should be promoted. 


For more information please contact: 
Damir Filipovic, Director Digital Enterprise and Consumer Policy 
+32 2 609 53 25 or damir.filipovic @ digitaleurope.org 
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ABOUT DIGITALEUROPE 


DIGITALEUROPE represents the digital technology industry in Europe. Our members include some of the world's largest IT, 
telecoms and consumer electronics companies and national associations from every part of Europe. DIGITALEUROPE wants 
European businesses and citizens to benefit fully from digital technologies and for Europe to grow, attract and sustain the 
world's best digital technology companies. 


DIGITALEUROPE ensures industry participation in the development and implementation of EU policies. DIGITALEUROPE’s 
members include 62 corporate members and 37 national trade associations from across Europe. Our website provides 
further information on our recent news and activities: http://www.digitaleurope.org 


DIGITALEUROPE MEMBERSHIP 


Corporate Members 


Airbus, Amazon Web Services, AMD, Apple, BlackBerry, Bose, Brother, CA Technologies, Canon, Cisco, Dell, Dropbox, Epson, 
Ericsson, Fujitsu, Google, Hewlett Packard Enterprise, Hitachi, HP Inc., Huawei, IBM, Ingram Micro, Intel, iQor, JVC Kenwood 
Group, Konica Minolta, Kyocera, Lenovo, Lexmark, LG Electronics, Loewe, Microsoft, Mitsubishi Electric Europe, Motorola 
Solutions, NEC, Nokia, Nvidia Ltd., Océ, Oki, Oracle, Panasonic Europe, Philips, Pioneer, Qualcomm, Ricoh Europe PLC, 
Samsung, SAP, SAS, Schneider Electric IT Corporation, Sharp Electronics, Siemens, Sony, Swatch Group, Technicolor, Texas 
Instruments, Toshiba, TP Vision, VMware, Western Digital, Xerox, Zebra Technologies, ZTE Corporation. 


National Trade Associations 


Austria: |OO Germany: BITKOM, ZVEI Slovakia: ITAS 

Belarus: INFOPARK Greece: SEPE Slovenia: GZS 
Belgium:AGORIA Hungary: IVSZ Spain: AMETIC 

Bulgaria: BAIT Ireland: ICT IRELAND Sweden: Foreningen 
Cyprus: CITEA Italy: ANITEC Teknikforetagen i Sverige, 


Denmark: DI Digital, IT-BRANCHEN 
Estonia: ITL 

Finland: FFTI 

France: AFNUM, Force Numérique, 
Tech in France 
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Lithuania: INFOBALT 
Netherlands: Nederland ICT, FIAR 
Poland: KIGEIT, PIIT, ZIPSEE 
Portugal: AGEFE 

Romania: ANIS, APDETIC 
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IT&Telekomforetagen 

Switzerland: SWICO 

Turkey: Digital Turkey Platform, ECID 
Ukraine: IT UKRAINE 

United Kingdom: techUK 





